Research map / Adversarial robustness and security / Attacks on text and graphs
DiffuPac: Contextual Mimicry in Adversarial Packets Generation via Diffusion Model
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DiffuPac, a BERT-initialized DiffuSeq-style diffusion model that generates adversarial network packet sequences by blending malicious flows into contextually paired benign traffic, evaluated against NIDS without surrogate classifiers.
Problem
Existing adversarial packet generators for NIDS assume attackers know NIDS internals (surrogate classifiers, feature extractors), which is unrealistic; the paper targets evasion under limited attacker knowledge.
Approach
Combine a pre-trained BERT (masked unidirectional flow and same-sequence-origin pretraining) with a DiffuSeq-style conditional diffusion model: contextually paired benign and malicious packet sequences are concatenated, only the malicious part is noised, and BERT serves as the denoiser guided by normal packets, so generated packets mimic benign traffic without NIDS access.
Key results
- DiffuPac outperforms Traffic Manipulator by 9.12 and TANTRA by 4.26 percentage points on average in evasion rate, a 6.69-point overall average gain.
- Simpler classifiers (DT, IF) were more resistant to evasion than DNN-based MLP/KitNET in the reported results.
- Up to 78.14% of successful DDoS adversarial samples were found OOD by the K-S test, versus 29.34% for MITM.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DiffuPac instead of Traffic Manipulator and TANTRA | Adversarial packet generation · All six attack types | Average MER: 6.69 percentage points | Helped |
| Use DiffuPac instead of Traffic Manipulator (GAN & PSO) | Adversarial packet generation · All six attack types | Average MER: 9.12 percentage points | Helped |
| Use DiffuPac instead of TANTRA (LSTM) | Adversarial packet generation · All six attack types | Average MER: 4.26 percentage points | Helped |
| Increase BERT configuration from Tiny to Medium (ablation) | BERT pre-training · BERT model comparison | MUM accuracy: 0.844 -> 0.905 | Helped |
| Increase BERT configuration from Tiny to Medium (ablation) | BERT pre-training · BERT model comparison | SSP accuracy: 0.846 -> 0.972 | Helped |
| Replace the pre-trained BERT denoiser with a standard transformer trained from scratch (ablation) | DiffuPac · Adversarial packet generation | evasion effectiveness | Mixed |
Surprising findings
- Simpler ML classifiers such as decision tree and isolation forest showed greater resilience than DNNs to the generated packets.
- Traffic Manipulator performed well against KitNET with AfterImage features, likely because it was trained on those features.
Limitations
- Functional validation limited to Port Scan and Brute Force attacks in a controlled environment.
- Evasion performance uneven across attack types, notably DDoS and Brute Force.
- Model checkpoints withheld due to dual-use concerns.
Experimental setup
Datasets: Kitsune CICIDS-2017
Benchmarks: Kitsune CICIDS-2017
Metrics: Malicious traffic Evasion Rate (MER) precision recall F1 out-of-distribution rate (K-S test)
Baselines: Traffic Manipulator (GAN & PSO) TANTRA (LSTM)
Builds on: DiffuSeq BERT ET-BERT Traffic Manipulator TANTRA
Closest papers by meaning
- UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · similarity 0.83)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.83)
- UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models (CVPR 2025 · similarity 0.83)
- Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policies (NeurIPS 2024 · similarity 0.83)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.83)
- TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.